If it doesn’t work

Question

I’m developing a website, in it some users will access and need to the password expires every 30 days. I did that check, but never falls into it, even when the if is true. If anyone has any idea what might be wrong or a tip to improve, thank you. Below follows the code in PHP.

  $cnpj               = $_POST['cnpj'];
  $senha              = $_POST['senha'];
  $hoje               = date('Y-m-d');

  $conexao            = mysqli_connect('localhost','root','') or print(mysqli_error());
  $db                 = mysqli_select_db($conexao, 'teste') or print(mysqli_error());

  $sql                = "SELECT * FROM usuario WHERE cnpj = '$cnpj' AND senha = '$senha'";
  $sql2               = "UPDATE usuario SET senha = 'expirou' WHERE cnpj = '$cnpj' and NOW() > data_senha"; 
  $sql3               = "UPDATE usuario SET data_senha = NOW() WHERE cnpj = '$cnpj'";
  $sql4               = "SELECT data_senha FROM usuario WHERE cnpj = '$cnpj'";

  $resultado_login    = mysqli_query($conexao, $sql);
  $data_senha         = mysqli_query($conexao, $sql4);

  if ($hoje >= $data_senha) {
    echo "<script> window.alert('Sua senha expirou! Entre em contato com a Rofran e solicite a nova senha.'); </script>";
    echo "<script> window.location.replace('../index.html'); </script>";
    $update_senha       = mysqli_query($conexao,$sql2);
    $update_data_senha  = mysqli_query($conexao,$sql3);
  }elseif(mysqli_num_rows($resultado_login) == 0){
    header("Location: ../erro.html");
    session_destroy();    
  }else{
    header("Location:../home.html");
    session_start();
  } 

I tested both date variables and return value, but in these tests I also noticed that they are not of the same type, even presenting the same format yyyy-mm-d.

Answer 1

Well, we have some problems with that code.

The first of these is the contents of $data_password. It will always be only the query text, because there is at no time the execution of it, nor the obtaining of the result.

The second is that when finding a query record, which is correct (the one that locates the user by cnpj and password), it already forwards the HTTP header that sends the browser to "home.html". So, whatever happens from there, the user will not notice - in case the warning messages that would be generated when fixing the first error.

The third of them is that the queries that should run at the end, within the if that checks the dates, are never executed. You just create them as a string, but there is no call to the mysqli_query method, which would finally execute them.

Fixing these three, your code should already work.

Answer 2

Consider this part of the code:

// ...
$data_senha = mysqli_query($conexao, $sql4);
if ($hoje >= $data_senha) {
// ...

The variable $data_senha does not have the value of the date, but an object MySQLi_Result. To get the desired value, it is necessary to use some function of fetch, like the mysqli_fetch_assoc, which returns an array containing the selected values.

In addition, as already noted in another reply, it is necessary to use the function strtotime to compare dates.

So..

// ...
$resultado_data_senha = mysqli_fetch_assoc(mysqli_query($conexao, $sql4));
$data_senha = $resultado_data_senha["data_senha"];
if (strtotime($hoje) >= strtotime($data_senha)) {
// ...

Answer 3

Make these changes and see if you’re dropping into the IF. Under the $data_password, enter:

$resultado_data = mysqli_query($conexao, $data_senha);
$linha= mysqli_fetch_assoc($resultado_data);

And replace the if with:

if($hoje >= $linha['data_senha'])

Answer 4

To compare dates should be used like this:

If(strtotime($hoje) >= strtotime($data_senha)){ }

Answer 5

After the help of @oeslei and @Antonioantunes, I changed the code and it is working. Below is the correct code:

<?php 

  $cnpj                  = $_POST['cnpj'];
  $senha                 = $_POST['senha'];
  $hoje                  = date('Y-m-d');

  $conexao               = mysqli_connect('localhost','root','') or print(mysqli_error());
  $db                    = mysqli_select_db($conexao, 'teste') or print(mysqli_error());

  $sql                   = "SELECT * FROM usuario WHERE cnpj = '$cnpj' AND senha = '$senha'";
  $sql2                  = "UPDATE usuario SET senha = 'expirou', data_senha = NOW() WHERE cnpj = '$cnpj' and NOW() > data_senha"; 
  $sql3                  = "SELECT data_senha FROM usuario WHERE cnpj = '$cnpj'";

  $resultado_login       = mysqli_query($conexao, $sql);
  $res_data_senha        = mysqli_fetch_assoc(mysqli_query($conexao, $sql3));
  $data_senha            = $res_data_senha["data_senha"];

  if($hoje >= $data_senha){
    echo "<script> window.alert('Sua senha expirou! Entre em contato e solicite a nova senha.'); </script>";
    echo "<script> window.location.replace('../index.html'); </script>";
    $update_senha_data   = mysqli_query($conexao, $sql2);
  }elseif(mysqli_num_rows($resultado_login) == 0){
    header("Location: ../erro.html");
    session_destroy();    
  }else{
    header("Location:../home.html");
    session_start();
  }

?>

Answer 6

A good way to debug would be to print the $data_password and mysql return variable data to check if the information is tapping.